API to create Address Group

[pamalhotra]

I am trying to create a new address group using API but I always end up getting

<response status="error" code="12">

<msg>

<line>

Invalid target object in set handler

</line>

</msg>

</response>

Can someone help me with the correct xpath to create a new shared address group empty or with a list of address objects.

[rodvand_de]

Do the operation in CLI first with the "debug cli on" command activated. This will give you the precise path you need for the API call.

See https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api...

[zmacharia_PA]

There are two types of address groups in the Palo Alto Networks firewalls; dynamic and static. By default, the firewall creates a static address group if you do not explicitly select dynamic. Therefore, you need to add the static element at the time of address group creation. The example below shows an example of creating an address-group named "test-address-group"

[https://<firewall-ip>/api/?type=config&action=set&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='test-address-group']&element=<static />&key=<yourfirewall-ip-key>]

Hope this explains the mystery.